--- name: "dsctl" section: "8" platform: "linux" package: "389-ds-base" version: "3.3.1-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/dsctl" --- # dsctl(8) ## NAME dsctl ## SYNOPSIS **dsctl** \[-h\] \[-v\] \[-j\] \[-l\] \[instance\] {restart,start,stop,status,remove,db2index,db2bak,db2ldif,dbverify,bak2db,ldif2db,backups,ldifs,index-check,tls,healthcheck,get-nsstate,ldifgen,dsrc,cockpit,dblib,thread-pool} ... ## POSITIONAL ARGUMENTS - **dsctl** *restart* Restart an instance of Directory Server, if it is running: else start it. - **dsctl** *start* Start an instance of Directory Server, if it is not currently running - **dsctl** *stop* Stop an instance of Directory Server, if it is currently running - **dsctl** *status* Check running status of an instance of Directory Server - **dsctl** *remove* Destroy an instance of Directory Server, and remove all data. - **dsctl** *db2index* Initialise a reindex of the server database. The server must be stopped for this to proceed. - **dsctl** *db2bak* Initialise a BDB backup of the database. The server must be stopped for this to proceed. - **dsctl** *db2ldif* Initialise an LDIF dump of the database. The server must be stopped for this to proceed. - **dsctl** *dbverify* Perform a db verification. You should only do this at direction of support - **dsctl** *bak2db* Restore a BDB backup of the database. The server must be stopped for this to proceed. - **dsctl** *ldif2db* Restore an LDIF dump of the database. The server must be stopped for this to proceed. - **dsctl** *backups* List backup's found in the server's default backup directory - **dsctl** *ldifs* List all the LDIF files located in the server's LDIF directory - **dsctl** *index-check* Check for index ordering mismatches (parentid/ancestorid). The server must be stopped. - **dsctl** *tls* Manage TLS certificates - **dsctl** *healthcheck* Run a healthcheck report on a local Directory Server instance. This is a safe and read-only operation. Do not attempt to run this on a remote Directory Server as this tool needs access to local resources, otherwise the report may be inaccurate. - **dsctl** *get-nsstate* Get the replication nsState in a human readable format Replica DN: The DN of the replication configuration entry Replica Suffix: The replicated suffix Replica ID: The Replica identifier Gen Time The time the CSN generator was created Gen Time String: The time string of generator Gen as CSN: The generation CSN Local Offset: The offset due to the local clock being set back Local Offset String: The offset in a nice human format Remote Offset: The offset due to clock difference with remote systems Remote Offset String: The offset in a nice human format Time Skew: The time skew between this server and its replicas Time Skew String: The time skew in a nice human format Seq Num: The number of multiple csns within a second System Time: The local system time Diff in Seconds: The time difference in seconds from the CSN generator creation to now Diff in days/secs: The time difference broken up into days and seconds Endian: Little/Big Endian - **dsctl** *ldifgen* LDIF generator to make sample LDIF files for testing - **dsctl** *dsrc* Manage the .dsrc file - **dsctl** *cockpit* Enable the Cockpit interface/UI - **dsctl** *dblib* database library (i.e bdb/lmdb) migration - **dsctl** *thread-pool* Offline thread pool diagnostics read from the local mmap status file ## COMMAND *'dsctl restart'* usage: dsctl \[-v\] \[-j\] \[instance\] restart \[-h\] ## COMMAND *'dsctl start'* usage: dsctl \[-v\] \[-j\] \[instance\] start \[-h\] ## COMMAND *'dsctl stop'* usage: dsctl \[-v\] \[-j\] \[instance\] stop \[-h\] ## COMMAND *'dsctl status'* usage: dsctl \[-v\] \[-j\] \[instance\] status \[-h\] ## COMMAND *'dsctl remove'* usage: dsctl \[-v\] \[-j\] \[instance\] remove \[-h\] \[--do-it\] ## OPTIONS *'dsctl remove'* - **--do-it** By default we do a dry run. This actually initiates the removal of the instance. ## COMMAND *'dsctl db2index'* usage: dsctl \[-v\] \[-j\] \[instance\] db2index \[-h\] \[--attr ATTR\] backend - **backend** The backend to reindex. IE userRoot ## OPTIONS *'dsctl db2index'* - **--attr** *ATTR* An attribute to reindex. IE: --attr member --attr cn ... ## COMMAND *'dsctl db2bak'* usage: dsctl \[-v\] \[-j\] \[instance\] db2bak \[-h\] \[--watch\] \[archive\] - **archive** The destination for the archive. This will be created during the db2bak process. ## OPTIONS *'dsctl db2bak'* - **--watch** Watch the status of the db2bak task ## COMMAND *'dsctl db2ldif'* usage: dsctl \[-v\] \[-j\] \[instance\] db2ldif \[-h\] \[--replication\] \[--encrypted\] \[--watch\]\ backend \[ldif\] - **backend** The backend to output as an LDIF. IE userRoot - **ldif** The path to the ldif output location. ## OPTIONS *'dsctl db2ldif'* - **--replication** Export replication information, suitable for importing on a new consumer or backups. - **--encrypted** Export encrypted attributes - **--watch** Watch the status of the db2ldif task ## COMMAND *'dsctl dbverify'* usage: dsctl \[-v\] \[-j\] \[instance\] dbverify \[-h\] backend - **backend** The backend to verify. IE userRoot ## COMMAND *'dsctl bak2db'* usage: dsctl \[-v\] \[-j\] \[instance\] bak2db \[-h\] \[--watch\] archive - **archive** The archive to restore. This will erase all current server databases. ## OPTIONS *'dsctl bak2db'* - **--watch** Watch the status of the bak2db task ## COMMAND *'dsctl ldif2db'* usage: dsctl \[-v\] \[-j\] \[instance\] ldif2db \[-h\] \[--encrypted\] \[--watch\] backend ldif - **backend** The backend to restore from an LDIF. IE userRoot - **ldif** The path to the ldif to import ## OPTIONS *'dsctl ldif2db'* - **--encrypted** Import encrypted attributes - **--watch** Watch the status of the ldif2db task ## COMMAND *'dsctl backups'* usage: dsctl \[-v\] \[-j\] \[instance\] backups \[-h\] \[--delete DELETE\] ## OPTIONS *'dsctl backups'* - **--delete** *DELETE* Delete backup directory ## COMMAND *'dsctl ldifs'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifs \[-h\] \[--delete DELETE\] ## OPTIONS *'dsctl ldifs'* - **--delete** *DELETE* Delete LDIF file ## COMMAND *'dsctl index-check'* usage: dsctl \[-v\] \[-j\] \[instance\] index-check \[-h\] \[--fix\] \[backend\] - **backend** Backend to check. If not specified, all backends are checked. ## OPTIONS *'dsctl index-check'* - **--fix** Fix mismatches by adjusting config to match on-disk data ## COMMAND *'dsctl tls'* usage: dsctl \[-v\] \[-j\] \[instance\] tls \[-h\]\ {list-ca,list-client-ca,show-server-cert,show-cert,generate-server-cert-csr,import-client-ca,import-ca,import-server-cert,import-server-key-cert,remove-cert,export-cert} ... ## POSITIONAL ARGUMENTS *'dsctl tls'* - **dsctl tls** *list-ca* list server certificate authorities including intermediates - **dsctl tls** *list-client-ca* list client certificate authorities including intermediates - **dsctl tls** *show-server-cert* Show the active server certificate that clients will see and verify - **dsctl tls** *show-cert* Show a certificate's details referenced by it's nickname. This is analogous to certutil -L -d \ -n \ - **dsctl tls** *generate-server-cert-csr* Generate a Server-Cert certificate signing request - the csr is then submitted to a CA for verification, and when signed you import with import-ca and import-server-cert - **dsctl tls** *import-client-ca* Import a CA trusted to issue user (client) certificates. This is part of how client certificate authentication functions. - **dsctl tls** *import-ca* Import a CA or intermediate CA for signing this servers certificates (aka Server-Cert). You should import all the CA's in the chain as required. PEM bundles are accepted - **dsctl tls** *import-server-cert* Import a new Server-Cert after the csr has been signed from a CA. - **dsctl tls** *import-server-key-cert* Import a new key and Server-Cert after having been signed from a CA. This is used if you have an external csr tool or a service like lets encrypt that generates PEM keys externally. - **dsctl tls** *remove-cert* Delete a certificate from this database. This will remove it from acting as a CA, a client CA or the Server-Cert role. - **dsctl tls** *export-cert* Export a certificate to PEM or DER/Binary format. PEM format is the default ## COMMAND *'dsctl tls list-ca'* usage: dsctl \[-v\] \[-j\] \[instance\] tls list-ca \[-h\] ## COMMAND *'dsctl tls list-client-ca'* usage: dsctl \[-v\] \[-j\] \[instance\] tls list-client-ca \[-h\] ## COMMAND *'dsctl tls show-server-cert'* usage: dsctl \[-v\] \[-j\] \[instance\] tls show-server-cert \[-h\]\ \[--nickname NICKNAME\] ## OPTIONS *'dsctl tls show-server-cert'* - **--nickname** *NICKNAME* The nickname (friendly name) of the certificate to display if different than ## COMMAND *'dsctl tls show-cert'* usage: dsctl \[-v\] \[-j\] \[instance\] tls show-cert \[-h\] nickname - **nickname** The nickname (friendly name) of the certificate to display ## COMMAND *'dsctl tls generate-server-cert-csr'* usage: dsctl \[-v\] \[-j\] \[instance\] tls generate-server-cert-csr\ \[-h\] \[--subject SUBJECT\] \[--nickname NICKNAME\] \[alt\_names ...\] - **alt\_names** Certificate requests subject alternative names. These are auto-detected if not provided ## OPTIONS *'dsctl tls generate-server-cert-csr'* - **--subject** *SUBJECT*, **-s** *SUBJECT* Certificate Subject field to use - **--nickname** *NICKNAME* The name of the certificate if different than 'Server-Cert' ## COMMAND *'dsctl tls import-client-ca'* usage: dsctl \[-v\] \[-j\] \[instance\] tls import-client-ca \[-h\] cert\_path nickname - **cert\_path** The path to the x509 cert to import as a client trust root - **nickname** The name of the certificate once imported ## COMMAND *'dsctl tls import-ca'* usage: dsctl \[-v\] \[-j\] \[instance\] tls import-ca \[-h\]\ cert\_path\ nickname \[nickname ...\] - **cert\_path** The path to the x509 cert to import as a server CA - **nickname** The name of the certificate once imported ## COMMAND *'dsctl tls import-server-cert'* usage: dsctl \[-v\] \[-j\] \[instance\] tls import-server-cert \[-h\]\ \[--nickname NICKNAME\]\ cert\_path - **cert\_path** The path to the x509 cert to import as Server-Cert ## OPTIONS *'dsctl tls import-server-cert'* - **--nickname** *NICKNAME* The name of the certificate if different than 'Server-Cert' ## COMMAND *'dsctl tls import-server-key-cert'* usage: dsctl \[-v\] \[-j\] \[instance\] tls import-server-key-cert\ \[-h\] \[--nickname NICKNAME\] cert\_path key\_path - **cert\_path** The path to the x509 cert to import as Server-Cert - **key\_path** The path to the x509 key to import associated to Server-Cert ## OPTIONS *'dsctl tls import-server-key-cert'* - **--nickname** *NICKNAME* The name of the certificate if different than 'Server-Cert' ## COMMAND *'dsctl tls remove-cert'* usage: dsctl \[-v\] \[-j\] \[instance\] tls remove-cert \[-h\] nickname - **nickname** The name of the certificate to delete ## COMMAND *'dsctl tls export-cert'* usage: dsctl \[-v\] \[-j\] \[instance\] tls export-cert \[-h\] \[--binary-format\]\ \[--output-file OUTPUT\_FILE\]\ nickname - **nickname** The name of the certificate to export ## OPTIONS *'dsctl tls export-cert'* - **--binary-format** Export certificate in DER/binary format - **--output-file** *OUTPUT\_FILE* The name for the exported certificate. Default name is the certificate nickname with an extension of ".pem" or ".crt" ## COMMAND *'dsctl healthcheck'* usage: dsctl \[instance\] healthcheck \[-h\] \[--list-checks\] \[--list-errors\]\ \[--dry-run\] \[--check CHECK \[CHECK ...\]\]\ \[--exclude-check EXCLUDE\_CHECK \[EXCLUDE\_CHECK ...\]\] ## OPTIONS *'dsctl healthcheck'* - **--list-checks** List of known checks - **--list-errors** List of known error codes - **--dry-run** Do not execute the actual check, only list what would be done - **--check** *CHECK \[CHECK ...\]* Areas to check. These can be obtained by --list-checks. Every element on the left of the colon (:) may be replaced by an asterisk if multiple options on the right are available. - **--exclude-check** *EXCLUDE\_CHECK \[EXCLUDE\_CHECK ...\]* Areas to skip. These can be obtained by --list-checks. Every element on the left of the colon (:) may be replaced by an asterisk if multiple options on the right are available. ## COMMAND *'dsctl get-nsstate'* usage: dsctl \[instance\] get-nsstate \[-h\] \[--suffix SUFFIX\] \[--flip FLIP\] ## OPTIONS *'dsctl get-nsstate'* - **--suffix** *SUFFIX* The DN of the replication suffix to read the state from - **--flip** *FLIP* Flip between Little/Big Endian, this might be required for certain architectures ## COMMAND *'dsctl ldifgen'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen \[-h\]\ {users,groups,cos-def,cos-template,roles,mod-load,nested} ... ## POSITIONAL ARGUMENTS *'dsctl ldifgen'* - **dsctl ldifgen** *users* Generate a LDIF containing user entries - **dsctl ldifgen** *groups* Generate a LDIF containing groups and members - **dsctl ldifgen** *cos-def* Generate a LDIF containing a COS definition (classic, pointer, or indirect) - **dsctl ldifgen** *cos-template* Generate a LDIF containing a COS template - **dsctl ldifgen** *roles* Generate a LDIF containing a role entry (managed, filtered, or indirect) - **dsctl ldifgen** *mod-load* Generate a LDIF containing modify operations. This is intended to be consumed by ldapmodify. - **dsctl ldifgen** *nested* Generate a heavily nested database LDIF in a cascading/fractal tree design ## COMMAND *'dsctl ldifgen users'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen users \[-h\] \[--number NUMBER\]\ \[--suffix SUFFIX\]\ \[--parent PARENT\] \[--generic\]\ \[--start-idx START\_IDX\]\ \[--rdn-cn\] \[--localize\]\ \[--ldif-file LDIF\_FILE\] ## OPTIONS *'dsctl ldifgen users'* - **--number** *NUMBER* The number of users to create. - **--suffix** *SUFFIX* The database suffix where the entries will be created. - **--parent** *PARENT* The parent entry that the user entries should be created under. If not specified, the entries are stored under random Organizational Units. - **--generic** Create generic entries in the format of "uid=user####". These entries are also compatible with ldclt. - **--start-idx** *START\_IDX* For generic LDIF's you can choose the starting index for the user entries. The default is "0". - **--rdn-cn** Use the attribute "cn" as the RDN attribute in the DN instead of "uid" - **--localize** Localize the LDIF data - **--ldif-file** *LDIF\_FILE* The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif' ## COMMAND *'dsctl ldifgen groups'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen groups \[-h\] \[--number NUMBER\]\ \[--suffix SUFFIX\]\ \[--parent PARENT\]\ \[--num-members NUM\_MEMBERS\]\ \[--create-members\]\ \[--member-parent MEMBER\_PARENT\]\ \[--member-attr MEMBER\_ATTR\]\ \[--ldif-file LDIF\_FILE\]\ NAME - **NAME** The group name. ## OPTIONS *'dsctl ldifgen groups'* - **--number** *NUMBER* The number of groups to create. - **--suffix** *SUFFIX* The database suffix where the groups will be created. - **--parent** *PARENT* The parent entry that the group entries should be created under. If not specified the groups are stored under the suffix. - **--num-members** *NUM\_MEMBERS* The number of members in the group. Default is 10000 - **--create-members** Create the member user entries. - **--member-parent** *MEMBER\_PARENT* The entry DN that the members should be created under. The default is the suffix entry. - **--member-attr** *MEMBER\_ATTR* The membership attribute to use in the group. Default is "uniquemember". - **--ldif-file** *LDIF\_FILE* The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif' ## COMMAND *'dsctl ldifgen cos-def'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen cos-def \[-h\] \[--type TYPE\]\ \[--parent PARENT\]\ \[--create-parent\]\ \[--cos-specifier COS\_SPECIFIER\]\ \[--cos-template COS\_TEMPLATE\]\ \[--cos-attr \[COS\_ATTR ...\]\]\ \[--ldif-file LDIF\_FILE\]\ NAME - **NAME** The COS definition name. ## OPTIONS *'dsctl ldifgen cos-def'* - **--type** *TYPE* The COS definition type: "classic", "pointer", or "indirect". - **--parent** *PARENT* The parent entry that the COS definition should be created under. - **--create-parent** Create the parent entry - **--cos-specifier** *COS\_SPECIFIER* Used in a classic COS definition, this attribute located in the user entry is used to select which COS template to use. - **--cos-template** *COS\_TEMPLATE* The DN of the COS template entry, only used for "classic" and "pointer" COS definitions. - **--cos-attr** *\[COS\_ATTR ...\]* A list of attributes which defines which attribute the COS generates values for. - **--ldif-file** *LDIF\_FILE* The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif' ## COMMAND *'dsctl ldifgen cos-template'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen cos-template \[-h\] \[--parent PARENT\]\ \[--create-parent\]\ \[--cos-priority COS\_PRIORITY\]\ \[--cos-attr-val COS\_ATTR\_VAL\]\ \[--ldif-file LDIF\_FILE\]\ NAME - **NAME** The COS template name. ## OPTIONS *'dsctl ldifgen cos-template'* - **--parent** *PARENT* The DN of the entry to store the COS template entry under. - **--create-parent** Create the parent entry - **--cos-priority** *COS\_PRIORITY* Sets the priority of this conflicting/competing COS templates. - **--cos-attr-val** *COS\_ATTR\_VAL* defines the attribute and value that the template provides. - **--ldif-file** *LDIF\_FILE* The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif' ## COMMAND *'dsctl ldifgen roles'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen roles \[-h\] \[--type TYPE\]\ \[--parent PARENT\]\ \[--create-parent\]\ \[--filter FILTER\]\ \[--role-dn \[ROLE\_DN ...\]\]\ \[--ldif-file LDIF\_FILE\]\ NAME - **NAME** The Role name. ## OPTIONS *'dsctl ldifgen roles'* - **--type** *TYPE* The Role type: "managed", "filtered", or "nested". - **--parent** *PARENT* The DN of the entry to store the Role entry under - **--create-parent** Create the parent entry - **--filter** *FILTER* A search filter for gathering Role members. Required for a "filtered" role. - **--role-dn** *\[ROLE\_DN ...\]* A DN of a role entry that should be included in this role. Used for "nested" roles only. - **--ldif-file** *LDIF\_FILE* The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif' ## COMMAND *'dsctl ldifgen mod-load'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen mod-load \[-h\] \[--create-users\]\ \[--delete-users\]\ \[--num-users NUM\_USERS\]\ \[--parent PARENT\]\ \[--create-parent\]\ \[--add-users ADD\_USERS\]\ \[--del-users DEL\_USERS\]\ \[--modrdn-users MODRDN\_USERS\]\ \[--mod-users MOD\_USERS\]\ \[--mod-attrs \[MOD\_ATTRS ...\]\]\ \[--randomize\]\ \[--ldif-file LDIF\_FILE\] ## OPTIONS *'dsctl ldifgen mod-load'* - **--create-users** Create the entries that will be modified or deleted. By default the script assumes the user entries already exist. - **--delete-users** Delete all the user entries at the end of the LDIF. - **--num-users** *NUM\_USERS* The number of user entries that will be modified or deleted - **--parent** *PARENT* The DN of the parent entry where the user entries are located. - **--create-parent** Create the parent entry - **--add-users** *ADD\_USERS* The number of additional entries to add during the load. - **--del-users** *DEL\_USERS* The number of entries to delete during the load. - **--modrdn-users** *MODRDN\_USERS* The number of entries to perform a modrdn operation on. - **--mod-users** *MOD\_USERS* The number of entries to modify. - **--mod-attrs** *\[MOD\_ATTRS ...\]* List of attributes the script will randomly choose from when modifying an entry. The default is "description". - **--randomize** Randomly perform the specified add, mod, delete, and modrdn operations - **--ldif-file** *LDIF\_FILE* The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif' ## COMMAND *'dsctl ldifgen nested'* usage: dsctl \[-v\] \[-j\] \[instance\] ldifgen nested \[-h\] \[--num-users NUM\_USERS\]\ \[--node-limit NODE\_LIMIT\]\ \[--suffix SUFFIX\]\ \[--ldif-file LDIF\_FILE\] ## OPTIONS *'dsctl ldifgen nested'* - **--num-users** *NUM\_USERS* The total number of user entries to create in the entire LDIF (does not include the container entries). - **--node-limit** *NODE\_LIMIT* The total number of user entries to create under each node/subtree - **--suffix** *SUFFIX* The suffix DN for the LDIF - **--ldif-file** *LDIF\_FILE* The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif' ## COMMAND *'dsctl dsrc'* usage: dsctl \[-v\] \[-j\] \[instance\] dsrc \[-h\] {create,modify,delete,display,repl-mon} ... ## POSITIONAL ARGUMENTS *'dsctl dsrc'* - **dsctl dsrc** *create* Generate the .dsrc file - **dsctl dsrc** *modify* Modify the .dsrc file - **dsctl dsrc** *delete* Delete instance configuration from the .dsrc file. - **dsctl dsrc** *display* Display the contents of the .dsrc file. - **dsctl dsrc** *repl-mon* Display the contents of the .dsrc file. ## COMMAND *'dsctl dsrc create'* usage: dsctl \[-v\] \[-j\] \[instance\] dsrc create \[-h\] \[--uri URI\]\ \[--basedn BASEDN\]\ \[--people-rdn PEOPLE\_RDN\]\ \[--groups-rdn GROUPS\_RDN\]\ \[--binddn BINDDN\]\ \[--saslmech SASLMECH\]\ \[--tls-cacertdir TLS\_CACERTDIR\]\ \[--tls-cert TLS\_CERT\]\ \[--tls-key TLS\_KEY\]\ \[--tls-reqcert TLS\_REQCERT\]\ \[--starttls\] \[--pwdfile PWDFILE\]\ \[--do-it\] ## OPTIONS *'dsctl dsrc create'* - **--uri** *URI* The URI (LDAP URL) for the Directory Server instance. - **--basedn** *BASEDN* The default database suffix. - **--people-rdn** *PEOPLE\_RDN* Set the RDN for the 'people' subtree. Default is "ou=people" - **--groups-rdn** *GROUPS\_RDN* Set the RDN for the 'groups' subtree. Default is "ou=groups" - **--binddn** *BINDDN* The default Bind DN used or authentication. - **--saslmech** *SASLMECH* The SASL mechanism to use: PLAIN or EXTERNAL. - **--tls-cacertdir** *TLS\_CACERTDIR* The directory containing the Trusted Certificate Authority certificate. - **--tls-cert** *TLS\_CERT* The absolute file name to the server certificate. - **--tls-key** *TLS\_KEY* The absolute file name to the server certificate key. - **--tls-reqcert** *TLS\_REQCERT* Request certificate strength: 'never', 'allow', 'hard' - **--starttls** Use startTLS for connection to the server. - **--pwdfile** *PWDFILE* The absolute path to a file containing the Bind DN's password. - **--do-it** Create the file without any confirmation. ## COMMAND *'dsctl dsrc modify'* usage: dsctl \[-v\] \[-j\] \[instance\] dsrc modify \[-h\] \[--uri \[URI\]\]\ \[--basedn \[BASEDN\]\]\ \[--people-rdn \[PEOPLE\_RDN\]\]\ \[--groups-rdn \[GROUPS\_RDN\]\]\ \[--binddn \[BINDDN\]\]\ \[--saslmech \[SASLMECH\]\]\ \[--tls-cacertdir \[TLS\_CACERTDIR\]\]\ \[--tls-cert \[TLS\_CERT\]\]\ \[--tls-key \[TLS\_KEY\]\]\ \[--tls-reqcert \[TLS\_REQCERT\]\]\ \[--starttls\] \[--cancel-starttls\]\ \[--pwdfile \[PWDFILE\]\] \[--do-it\] ## OPTIONS *'dsctl dsrc modify'* - **--uri** *\[URI\]* The URI (LDAP URL) for the Directory Server instance. - **--basedn** *\[BASEDN\]* The default database suffix. - **--people-rdn** *\[PEOPLE\_RDN\]* Sets the RDN used for the 'people' container - **--groups-rdn** *\[GROUPS\_RDN\]* Sets the RDN used for the 'groups' container - **--binddn** *\[BINDDN\]* The default Bind DN used or authentication. - **--saslmech** *\[SASLMECH\]* The SASL mechanism to use: PLAIN or EXTERNAL. - **--tls-cacertdir** *\[TLS\_CACERTDIR\]* The directory containing the Trusted Certificate Authority certificate. - **--tls-cert** *\[TLS\_CERT\]* The absolute file name to the server certificate. - **--tls-key** *\[TLS\_KEY\]* The absolute file name to the server certificate key. - **--tls-reqcert** *\[TLS\_REQCERT\]* Request certificate strength: 'never', 'allow', 'hard' - **--starttls** Use startTLS for connection to the server. - **--cancel-starttls** Do not use startTLS for connection to the server. - **--pwdfile** *\[PWDFILE\]* The absolute path to a file containing the Bind DN's password. - **--do-it** Update the file without any confirmation. ## COMMAND *'dsctl dsrc delete'* usage: dsctl \[-v\] \[-j\] \[instance\] dsrc delete \[-h\] \[--do-it\] ## OPTIONS *'dsctl dsrc delete'* - **--do-it** Delete this instance's configuration from the .dsrc file. ## COMMAND *'dsctl dsrc display'* usage: dsctl \[-v\] \[-j\] \[instance\] dsrc display \[-h\] ## COMMAND *'dsctl dsrc repl-mon'* usage: dsctl \[-v\] \[-j\] \[instance\] dsrc repl-mon \[-h\]\ \[--add-conn ADD\_CONN \[ADD\_CONN ...\]\]\ \[--del-conn DEL\_CONN \[DEL\_CONN ...\]\]\ \[--add-alias ADD\_ALIAS \[ADD\_ALIAS ...\]\]\ \[--del-alias DEL\_ALIAS \[DEL\_ALIAS ...\]\] ## OPTIONS *'dsctl dsrc repl-mon'* - **--add-conn** *ADD\_CONN \[ADD\_CONN ...\]* Add a replica connection: 'NAME:HOST:PORT:BINDDN:CREDENTIAL' - **--del-conn** *DEL\_CONN \[DEL\_CONN ...\]* delete a replica connection by its NAME - **--add-alias** *ADD\_ALIAS \[ADD\_ALIAS ...\]* Add a host/port alias: 'ALIAS\_NAME:HOST:PORT' - **--del-alias** *DEL\_ALIAS \[DEL\_ALIAS ...\]* delete a host/port alias by its ALIAS\_NAME ## COMMAND *'dsctl cockpit'* usage: dsctl \[-v\] \[-j\] \[instance\] cockpit \[-h\]\ {enable,open-firewall,disable,close-firewall} ... ## POSITIONAL ARGUMENTS *'dsctl cockpit'* - **dsctl cockpit** *enable* Enable the Cockpit socket - **dsctl cockpit** *open-firewall* Open the firewall for the "cockpit" service - **dsctl cockpit** *disable* Disable the Cockpit socket - **dsctl cockpit** *close-firewall* Remove the "cockpit" service from the firewall settings ## COMMAND *'dsctl cockpit enable'* usage: dsctl \[-v\] \[-j\] \[instance\] cockpit enable \[-h\] ## COMMAND *'dsctl cockpit open-firewall'* usage: dsctl \[-v\] \[-j\] \[instance\] cockpit open-firewall \[-h\] \[--zone ZONE\] ## OPTIONS *'dsctl cockpit open-firewall'* - **--zone** *ZONE* The firewall zone ## COMMAND *'dsctl cockpit disable'* usage: dsctl \[-v\] \[-j\] \[instance\] cockpit disable \[-h\] ## COMMAND *'dsctl cockpit close-firewall'* usage: dsctl \[-v\] \[-j\] \[instance\] cockpit close-firewall \[-h\] ## COMMAND *'dsctl dblib'* usage: dsctl \[-v\] \[-j\] \[instance\] dblib \[-h\] {bdb2mdb,mdb2bdb,cleanup} ... ## POSITIONAL ARGUMENTS *'dsctl dblib'* - **dsctl dblib** *bdb2mdb* Migrate bdb databases to lmdb - **dsctl dblib** *mdb2bdb* Migrate lmdb databases to bdb - **dsctl dblib** *cleanup* Remove migration ldif file and old database ## COMMAND *'dsctl dblib bdb2mdb'* usage: dsctl \[-v\] \[-j\] \[instance\] dblib bdb2mdb \[-h\] \[--tmpdir TMPDIR\] ## OPTIONS *'dsctl dblib bdb2mdb'* - **--tmpdir** *TMPDIR* ldif migration files directory path. ## COMMAND *'dsctl dblib mdb2bdb'* usage: dsctl \[-v\] \[-j\] \[instance\] dblib mdb2bdb \[-h\] \[--tmpdir TMPDIR\] ## OPTIONS *'dsctl dblib mdb2bdb'* - **--tmpdir** *TMPDIR* ldif migration files directory path. ## COMMAND *'dsctl dblib cleanup'* usage: dsctl \[-v\] \[-j\] \[instance\] dblib cleanup \[-h\] ## COMMAND *'dsctl thread-pool'* usage: dsctl \[-v\] \[-j\] \[instance\] thread-pool \[-h\] {status} ... ## POSITIONAL ARGUMENTS *'dsctl thread-pool'* - **dsctl thread-pool** *status* Display pool gauges and per-worker activity without an LDAP connection ## COMMAND *'dsctl thread-pool status'* usage: dsctl \[-v\] \[-j\] \[instance\] thread-pool status \[-h\] \[--file FILE\] ## OPTIONS *'dsctl thread-pool status'* - **--file** *FILE* Read this thread-pool status file instead of the instance's live file (e.g. a crash file preserved as threadpool.YYYYMMDD-HHMMSS) ## OPTIONS - **-v**, **--verbose** Display verbose operation tracing during command execution - **-j**, **--json** Return result in JSON object - **-l**, **--list** List available Directory Server instances ## AUTHOR ``` "Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org> ```